Privacy Policy

This Privacy Policy explains how Sukify collects, uses, shares, and protects personal data. It covers two groups of people: merchants (business owners and their staff) and customers (the cardholders who use loyalty cards). We have marked the parts that are specific to each group. This policy is written to meet the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its rules. We aim to follow GDPR-aligned privacy principles where practical and to honor core privacy rights for all users, wherever they are.

Who we are

Sukify is a digital loyalty platform that helps small and medium businesses replace paper stamp cards with QR-based digital alternatives. Sukify is owned and operated by Konseptu IT Consultancy, a business registered in the Philippines:

• Konseptu IT Consultancy
• 143 F. Ramos St., Cogon Ramos, City of Cebu, Cebu 6000, Philippines
• Business Permit No. 200412 · TIN 337-556-415-00000
• Email: contact@konseptu.com

Our role: controller and processor

Data-protection law distinguishes between the party that decides why and how data is used (the controller, called the Personal Information Controller under Philippine law) and the party that handles data on the controller's instructions (the processor).

• We are the controller of merchant account data and of the data tied to a customer's own Sukify account and identity (for example, your login, profile, and the optional details you choose to share). We are also an independent controller for the platform-level activities we decide on ourselves, such as account identity and authentication, security and fraud prevention, audit logs, diagnostics and error handling, and compliance with our own legal obligations.
• We are a processor for the loyalty data that a merchant collects through its own program (for example, the stamps and redemptions on that merchant's cards). For that data the merchant is the controller and decides how it is used, and we act on the merchant's behalf and on its instructions under our Merchant Terms of Service.

Data Protection Officer

We have designated a Data Protection Officer (DPO) who oversees our compliance and is your point of contact for any privacy question, request, or concern.

• Data Protection Officer, Konseptu IT Consultancy
• Email: dpo@sukify.ph (or contact@konseptu.com)
• 143 F. Ramos St., Cogon Ramos, City of Cebu, Cebu 6000, Philippines

What data we collect

From merchants:

• Name, email address, phone number
• Business name, logo, and branding preferences
• Branch and location information
• Billing and payment details

From customers:

• Name (as provided during card creation)
• Phone number or email (for account access and recovery)
• Profile and preferences (such as birthdate, notification settings, and interests you choose to share)
• Stamp and visit history and redemption records
• Device and technical information (for security and analytics)

Signing in with Facebook, Google, or Apple

If you choose to create or access your Sukify account using a third-party login, we receive a limited set of profile information from that provider so we can identify you and set up your account. We do not receive your password, and we never post to your social accounts.

When you sign in with Facebook (Meta), we receive your name, your email address (if you grant permission), your profile picture, and your Facebook user ID. We use this only to authenticate you, create and secure your Sukify account, and contact you about the service. We do not use it for advertising, and we do not sell it. The same applies to sign-in with Google and Apple, where we receive your name and email address.

You can disconnect Facebook from Sukify at any time in Facebook → Settings & Privacy → Settings → Apps and Websites by removing Sukify. Revoking access prevents future logins via Facebook; to also delete the data we already hold, see "Deleting your data" below.

How we use your data, and our legal basis

We only process personal data when we have a lawful basis to do so. The table below sets out what we do and why, using the bases recognized under the Data Privacy Act and the GDPR.

Where we rely on consent, you may withdraw it at any time without affecting processing that already happened. Where we rely on legitimate interests, we balance those interests against your rights, and you may object as described under "Your rights."

Data storage and security

Your data is stored on enterprise-grade cloud infrastructure. We use encryption in transit (HTTPS/TLS) and at rest, role-based access controls, and database-level isolation between tenants. Access to production data is restricted to authorized team members who need it for their work. We review our organizational, physical, and technical safeguards as the service grows.

Data sharing

We do not sell your data, and we do not broadly share it. When we do share data with a third party, we share only the specific data needed for that exact purpose, never your full record. Specifically:

• Payment processors receive only the billing details required to process a payment.
• Cloud infrastructure providers store your data on our behalf so we can run the service. Your data sits in our infrastructure and is not handed over for the provider's own use.
• Messaging and notification providers receive only what is needed to deliver a message you have agreed to receive.

We do not feed your personal data into analytics or debugging tools for general analysis. In limited cases while diagnosing an error, account data may incidentally appear in our diagnostic tooling where it helps us fix the problem; it is used only for that purpose and not retained beyond it.

Merchants can see their own customers' stamp and visit data through the analytics dashboard. They cannot access other merchants' data. We may also disclose data where the law requires it, such as a valid legal order, or to protect the rights, safety, and security of users and the public.

International data transfers

Sukify is operated from the Philippines, and we aim to keep data within trusted infrastructure. Some of our service providers may process or store data outside the Philippines, including outside the EU/EEA. When data is transferred across borders, we make sure it stays protected by appropriate safeguards, such as contractual data-protection terms (including Standard Contractual Clauses where the GDPR applies) and providers that maintain recognized security standards. We remain accountable for personal data that a provider processes for us.

Your rights

Wherever you are, you have the following rights over your personal data. Under the Philippine Data Privacy Act these include the rights to be informed, to access, to object, to erasure or blocking, to rectify, to data portability, to damages, and to file a complaint. Under the GDPR they include the rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.

• Be informed about how your data is collected and used, as set out in this policy.
• Access a copy of the personal data we hold about you.
• Correct data that is inaccurate or out of date.
• Object to or restrict certain processing, including processing based on legitimate interests, and opt out of marketing.
• Erase or block your data, subject to the exceptions in "Deleting your data."
• Portability: receive your data in a structured, commonly used format, and merchants can export their customer data from the dashboard.
• Withdraw consent at any time where we rely on it.
• Lodge a complaint with a supervisory authority (see "Complaints" below).

To exercise any of these rights, contact our DPO at dpo@sukify.ph. We will respond within the period the law requires, and we may need to verify your identity first. These services are free, though we may charge a reasonable fee or decline a request that is clearly unfounded or excessive, as the law allows.

Automated decisions

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, and we do not carry out profiling that has such effects. Analytics shown to merchants summarize visit and stamp activity and are not used to make automated decisions about individual customers.

Data breach notification

We maintain procedures to detect, assess, and respond to personal data breaches. If a breach is likely to give rise to a real risk of serious harm, we will notify the National Privacy Commission and the affected individuals within the timeframes required by law, and, where the GDPR applies, the relevant supervisory authority without undue delay and within 72 hours where feasible. When we act as a processor for a merchant, we will notify that merchant without undue delay so it can meet its own obligations.

Deleting your data

You can delete your Sukify account and the personal data associated with it in two ways:

• In the app: open your account settings and choose "Delete account." Your account is deactivated immediately.
• By email: send a deletion request to contact@sukify.ph from the email address on your account, or to dpo@sukify.ph.

Once requested, we permanently delete your personal data within 90 days. The one exception is records that a merchant needs for its own business analytics, such as a visit or a redemption. We do not delete these, because doing so would distort the merchant's historical totals; instead we fully anonymize them, irreversibly stripping every detail that could link the record back to you. After anonymization the record is no longer personal data. We may also retain certain records longer where the law requires it (for example, billing and tax records). If you signed in with Facebook, deleting your Sukify account also removes the profile data we received from Facebook. You can also visit our data deletion page for step-by-step instructions.

Data retention

We keep your personal data for as long as your account is active. After you delete your account, we permanently delete the data that identifies you within 90 days. Records kept for merchant analytics are irreversibly anonymized so they can no longer be linked to you, and records we are legally required to keep (such as tax and accounting records) are retained only for the period the law requires and only for that purpose.

Children's privacy

Sukify is intended for users aged 18 and over, and for users aged 13 to 18 only with the consent and supervision of a parent or guardian. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact our DPO and we will delete it.

Cookies and tracking

Our website uses only essential cookies for authentication and session management. We do not currently use analytics cookies, advertising cookies, or third-party trackers. If we introduce non-essential analytics cookies in the future, we will name them, keep them switched off by default, and load them only after you have given consent, which you can withdraw at any time.

Complaints

If you have a concern about how we handle your data, please contact our DPO first so we can try to resolve it. You also have the right to complain to a regulator. In the Philippines, that is the National Privacy Commission (privacy.gov.ph). If you are in the EU/EEA, you may complain to the supervisory authority in your country.

Changes to this policy

We may update this policy as Sukify grows. We will notify merchants by email and post a notice for customers for any significant changes. The "last updated" date at the top will always reflect the most recent revision.

Contact us

If you have questions about this privacy policy or your data, email us at contact@sukify.ph, reach our Data Protection Officer at dpo@sukify.ph, or reach out via Viber or Facebook Messenger. We aim to respond within 24 hours.